Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b21e1149051218c49d7cf1f850cd37e.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b21e1149051218c49d7cf1f850cd37e.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0b21e1149051218c49d7cf1f850cd37e.exe
-
Size
629KB
-
MD5
0b21e1149051218c49d7cf1f850cd37e
-
SHA1
8f2a8a734c91ebf60abc6b65bf6dd21e93c4bd1b
-
SHA256
aab24fcb8d398b1a8b1af7b2fbb4dcb1708857dbe96b661fbc8a8c82daaa5d83
-
SHA512
8a0fdc4fd8133e60ca110f2839ed25520f410767f9d1582beac0d64d3ab4f4f1d71be9a184e8dd308d682e6c186fbf276e0b55e010ae3abf612af64d2c9e6db7
-
SSDEEP
12288:pp4pNfz3ymJnJ8QCFkxCaQTOlxSU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXhFR:DEtl9mRda10SGB2uJ2s4otqFCJrW9FqT
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 0b21e1149051218c49d7cf1f850cd37e.exe -
Executes dropped EXE 1 IoCs
pid Process 4340 HelpMe.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\W: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\H: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\I: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\E: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\L: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\R: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\B: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\T: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\U: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\X: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\N: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\Y: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\J: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\K: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\P: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\Z: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\G: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\M: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\Q: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\S: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\V: 0b21e1149051218c49d7cf1f850cd37e.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\A: 0b21e1149051218c49d7cf1f850cd37e.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 0b21e1149051218c49d7cf1f850cd37e.exe File opened for modification C:\AUTORUN.INF 0b21e1149051218c49d7cf1f850cd37e.exe File opened for modification F:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\7-Zip\7-zip.dll.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7-zip32.dll.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7z.dll.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\descript.ion.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\History.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7z.exe.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\ar.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\ast.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7z.sfx.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7zFM.exe.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\az.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\ba.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7-zip.chm.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7zCon.sfx.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\7zG.exe.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\af.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\an.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe File created C:\Program Files\7-Zip\Lang\be.txt.exe 0b21e1149051218c49d7cf1f850cd37e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4428 wrote to memory of 4340 4428 0b21e1149051218c49d7cf1f850cd37e.exe 18 PID 4428 wrote to memory of 4340 4428 0b21e1149051218c49d7cf1f850cd37e.exe 18 PID 4428 wrote to memory of 4340 4428 0b21e1149051218c49d7cf1f850cd37e.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b21e1149051218c49d7cf1f850cd37e.exe"C:\Users\Admin\AppData\Local\Temp\0b21e1149051218c49d7cf1f850cd37e.exe"1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:4340
-